s3:smbd: add a optional_support helper variable to reply_tcon_and_X()
[kai/samba.git] / source3 / smbd / reply.c
index ad72e4b7a9dd7eed8bb32bcd126cd5f68efdb3e3..a89338082f60f995d74ad2f43c02e52b0e816813 100644 (file)
@@ -32,6 +32,7 @@
 #include "fake_file.h"
 #include "rpc_client/rpc_client.h"
 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
+#include "../librpc/gen_ndr/open_files.h"
 #include "rpc_client/cli_spoolss.h"
 #include "rpc_client/init_spoolss.h"
 #include "rpc_server/rpc_ncacn_np.h"
@@ -39,6 +40,8 @@
 #include "libsmb/nmblib.h"
 #include "auth.h"
 #include "smbprofile.h"
+#include "../lib/tsocket/tsocket.h"
+#include "lib/tevent_wait.h"
 
 /****************************************************************************
  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
@@ -314,7 +317,7 @@ size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
                                 char **pp_dest, const char *src, int flags,
                                 NTSTATUS *err, bool *contains_wcard)
 {
-       return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
+       return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf, req->flags2,
                                     pp_dest, src, smbreq_bufrem(req, src),
                                     flags, err, contains_wcard);
 }
@@ -408,13 +411,13 @@ static bool netbios_session_retarget(struct smbd_server_connection *sconn,
        char *retarget;
        char *p;
        int retarget_type = 0x20;
-       int retarget_port = 139;
+       int retarget_port = NBT_SMB_PORT;
        struct sockaddr_storage retarget_addr;
        struct sockaddr_in *in_addr;
        bool ret = false;
        uint8_t outbuf[10];
 
-       if (get_socket_port(sconn->sock) != 139) {
+       if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
                return false;
        }
 
@@ -481,7 +484,7 @@ static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 
        if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
                          NULL)) {
-               exit_server_cleanly("netbios_session_regarget: srv_send_smb "
+               exit_server_cleanly("netbios_session_retarget: srv_send_smb "
                                    "failed.");
        }
 
@@ -491,6 +494,13 @@ static bool netbios_session_retarget(struct smbd_server_connection *sconn,
        return ret;
 }
 
+static void reply_called_name_not_present(char *outbuf)
+{
+       smb_setlen(outbuf, 1);
+       SCVAL(outbuf, 0, 0x83);
+       SCVAL(outbuf, 4, 0x82);
+}
+
 /****************************************************************************
  Reply to a (netbios-level) special message. 
 ****************************************************************************/
@@ -511,7 +521,7 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
        smb_setlen(outbuf,0);
 
        switch (msg_type) {
-       case 0x81: /* session request */
+       case NBSSrequest: /* session request */
        {
                /* inbuf_size is guarenteed to be at least 4. */
                fstring name1,name2;
@@ -524,18 +534,20 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
                        exit_server_cleanly("multiple session request not permitted");
                }
 
-               SCVAL(outbuf,0,0x82);
+               SCVAL(outbuf,0,NBSSpositive);
                SCVAL(outbuf,3,0);
 
                /* inbuf_size is guaranteed to be at least 4. */
                name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
                if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
                        DEBUG(0,("Invalid name length in session request\n"));
+                       reply_called_name_not_present(outbuf);
                        break;
                }
                name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
                if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
                        DEBUG(0,("Invalid name length in session request\n"));
+                       reply_called_name_not_present(outbuf);
                        break;
                }
 
@@ -546,6 +558,7 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
 
                if (name_type1 == -1 || name_type2 == -1) {
                        DEBUG(0,("Invalid name type in session request\n"));
+                       reply_called_name_not_present(outbuf);
                        break;
                }
 
@@ -562,7 +575,15 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
                 */
                if (strequal(name1, "*SMBSERVER     ")
                    || strequal(name1, "*SMBSERV       "))  {
-                       fstrcpy(name1, sconn->client_id.addr);
+                       char *raddr;
+
+                       raddr = tsocket_address_inet_addr_string(sconn->remote_address,
+                                                                talloc_tos());
+                       if (raddr == NULL) {
+                               exit_server_cleanly("could not allocate raddr");
+                       }
+
+                       fstrcpy(name1, raddr);
                }
 
                set_local_machine_name(name1, True);
@@ -575,18 +596,11 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
                if (name_type2 == 'R') {
                        /* We are being asked for a pathworks session --- 
                           no thanks! */
-                       SCVAL(outbuf, 0,0x83);
+                       reply_called_name_not_present(outbuf);
                        break;
                }
 
-               /* only add the client's machine name to the list
-                  of possibly valid usernames if we are operating
-                  in share mode security */
-               if (lp_security() == SEC_SHARE) {
-                       add_session_user(sconn, get_remote_machine_name());
-               }
-
-               reload_services(sconn->msg_ctx, sconn->sock, True);
+               reload_services(sconn, conn_snum_used, true);
                reopen_logs();
 
                sconn->nbt.got_session = true;
@@ -595,17 +609,17 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
 
        case 0x89: /* session keepalive request 
                      (some old clients produce this?) */
-               SCVAL(outbuf,0,SMBkeepalive);
+               SCVAL(outbuf,0,NBSSkeepalive);
                SCVAL(outbuf,3,0);
                break;
 
-       case 0x82: /* positive session response */
-       case 0x83: /* negative session response */
-       case 0x84: /* retarget session response */
+       case NBSSpositive: /* positive session response */
+       case NBSSnegative: /* negative session response */
+       case NBSSretarget: /* retarget session response */
                DEBUG(0,("Unexpected session response\n"));
                break;
 
-       case SMBkeepalive: /* session keepalive */
+       case NBSSkeepalive: /* session keepalive */
        default:
                return;
        }
@@ -614,6 +628,10 @@ void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inb
                    msg_type, msg_flags));
 
        srv_send_smb(sconn, outbuf, false, 0, false, NULL);
+
+       if (CVAL(outbuf, 0) != 0x82) {
+               exit_server_cleanly("invalid netbios session");
+       }
        return;
 }
 
@@ -632,7 +650,6 @@ void reply_tcon(struct smb_request *req)
        int pwlen=0;
        NTSTATUS nt_status;
        const char *p;
-       DATA_BLOB password_blob;
        TALLOC_CTX *ctx = talloc_tos();
        struct smbd_server_connection *sconn = req->sconn;
 
@@ -664,14 +681,10 @@ void reply_tcon(struct smb_request *req)
                service = service_buf;
        }
 
-       password_blob = data_blob(password, pwlen+1);
-
-       conn = make_connection(sconn,service,password_blob,dev,
+       conn = make_connection(sconn,service,dev,
                               req->vuid,&nt_status);
        req->conn = conn;
 
-       data_blob_clear_free(&password_blob);
-
        if (!conn) {
                reply_nterror(req, nt_status);
                END_PROFILE(SMBtcon);
@@ -699,7 +712,6 @@ void reply_tcon_and_X(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        const char *service = NULL;
-       DATA_BLOB password;
        TALLOC_CTX *ctx = talloc_tos();
        /* what the cleint thinks the device is */
        char *client_devicetype = NULL;
@@ -724,10 +736,32 @@ void reply_tcon_and_X(struct smb_request *req)
        tcon_flags = SVAL(req->vwv+2, 0);
 
        /* we might have to close an old one */
-       if ((tcon_flags & 0x1) && conn) {
-               close_cnum(conn,req->vuid);
+       if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
+               struct smbXsrv_tcon *tcon;
+               NTSTATUS status;
+
+               tcon = conn->tcon;
                req->conn = NULL;
                conn = NULL;
+
+               /*
+                * TODO: cancel all outstanding requests on the tcon
+                */
+               status = smbXsrv_tcon_disconnect(tcon, req->vuid);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DEBUG(0, ("reply_tcon_and_X: "
+                                 "smbXsrv_tcon_disconnect() failed: %s\n",
+                                 nt_errstr(status)));
+                       /*
+                        * If we hit this case, there is something completely
+                        * wrong, so we better disconnect the transport connection.
+                        */
+                       END_PROFILE(SMBtconX);
+                       exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
+                       return;
+               }
+
+               TALLOC_FREE(tcon);
        }
 
        if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
@@ -737,27 +771,14 @@ void reply_tcon_and_X(struct smb_request *req)
        }
 
        if (sconn->smb1.negprot.encrypted_passwords) {
-               password = data_blob_talloc(talloc_tos(), req->buf, passlen);
-               if (lp_security() == SEC_SHARE) {
-                       /*
-                        * Security = share always has a pad byte
-                        * after the password.
-                        */
-                       p = (const char *)req->buf + passlen + 1;
-               } else {
-                       p = (const char *)req->buf + passlen;
-               }
+               p = (const char *)req->buf + passlen;
        } else {
-               password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
-               /* Ensure correct termination */
-               password.data[passlen]=0;
                p = (const char *)req->buf + passlen + 1;
        }
 
        p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 
        if (path == NULL) {
-               data_blob_clear_free(&password);
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBtconX);
                return;
@@ -770,7 +791,6 @@ void reply_tcon_and_X(struct smb_request *req)
        if (*path=='\\') {
                q = strchr_m(path+2,'\\');
                if (!q) {
-                       data_blob_clear_free(&password);
                        reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
                        END_PROFILE(SMBtconX);
                        return;
@@ -785,7 +805,6 @@ void reply_tcon_and_X(struct smb_request *req)
                                MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 
        if (client_devicetype == NULL) {
-               data_blob_clear_free(&password);
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBtconX);
                return;
@@ -793,12 +812,10 @@ void reply_tcon_and_X(struct smb_request *req)
 
        DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 
-       conn = make_connection(sconn, service, password, client_devicetype,
+       conn = make_connection(sconn, service, client_devicetype,
                               req->vuid, &nt_status);
        req->conn =conn;
 
-       data_blob_clear_free(&password);
-
        if (!conn) {
                reply_nterror(req, nt_status);
                END_PROFILE(SMBtconX);
@@ -822,7 +839,8 @@ void reply_tcon_and_X(struct smb_request *req)
                }
        } else {
                /* NT sets the fstype of IPC$ to the null string */
-               const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
+               const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
+               uint16_t optional_support = 0;
 
                if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
                        /* Return permissions. */
@@ -835,9 +853,7 @@ void reply_tcon_and_X(struct smb_request *req)
                                perm1 = FILE_ALL_ACCESS;
                                perm2 = FILE_ALL_ACCESS;
                        } else {
-                               perm1 = CAN_WRITE(conn) ?
-                                               SHARE_ALL_ACCESS :
-                                               SHARE_READ_ONLY;
+                               perm1 = conn->share_access;
                        }
 
                        SIVAL(req->outbuf, smb_vwv3, perm1);
@@ -857,30 +873,32 @@ void reply_tcon_and_X(struct smb_request *req)
 
                /* what does setting this bit do? It is set by NT4 and
                   may affect the ability to autorun mounted cdroms */
-               SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
-                     (lp_csc_policy(SNUM(conn)) << 2));
+               optional_support |= SMB_SUPPORT_SEARCH_BITS;
+               optional_support |=
+                       (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
 
                if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
                        DEBUG(2,("Serving %s as a Dfs root\n",
-                                lp_servicename(SNUM(conn)) ));
-                       SSVAL(req->outbuf, smb_vwv2,
-                             SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
+                                lp_servicename(ctx, SNUM(conn)) ));
+                       optional_support |= SMB_SHARE_IN_DFS;
                }
+
+               SSVAL(req->outbuf, smb_vwv2, optional_support);
        }
 
+       SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+       SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 
        DEBUG(3,("tconX service=%s \n",
                 service));
 
        /* set the incoming and outgoing tid to the just created one */
-       SSVAL(req->inbuf,smb_tid,conn->cnum);
+       SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
        SSVAL(req->outbuf,smb_tid,conn->cnum);
 
        END_PROFILE(SMBtconX);
 
        req->tid = conn->cnum;
-       chain_reply(req);
-       return;
 }
 
 /****************************************************************************
@@ -952,17 +970,16 @@ void reply_ioctl(struct smb_request *req)
                                return;
                        }
                        /* Job number */
-                       if (fsp->print_file) {
-                               SSVAL(p, 0, fsp->print_file->rap_jobid);
-                       } else {
-                               SSVAL(p, 0, 0);
-                       }
+                       SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
+
                        srvstr_push((char *)req->outbuf, req->flags2, p+2,
-                                   global_myname(), 15,
+                                   lp_netbios_name(), 15,
                                    STR_TERMINATE|STR_ASCII);
                        if (conn) {
                                srvstr_push((char *)req->outbuf, req->flags2,
-                                           p+18, lp_servicename(SNUM(conn)),
+                                           p+18,
+                                           lp_servicename(talloc_tos(),
+                                                          SNUM(conn)),
                                            13, STR_TERMINATE|STR_ASCII);
                        } else {
                                memset(p+18, 0, 13);
@@ -1089,7 +1106,7 @@ void reply_getatr(struct smb_request *req)
        struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
        int mode=0;
-       SMB_OFF_T size=0;
+       off_t size=0;
        time_t mtime=0;
        const char *p;
        NTSTATUS status;
@@ -1108,7 +1125,7 @@ void reply_getatr(struct smb_request *req)
        /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
                under WfWg - weird! */
        if (*fname == '\0') {
-               mode = FILE_ATTRIBUTE_HIDDEN | aDIR;
+               mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
                if (!CAN_WRITE(conn)) {
                        mode |= FILE_ATTRIBUTE_READONLY;
                }
@@ -1156,7 +1173,7 @@ void reply_getatr(struct smb_request *req)
                }
 
                mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
-               if (mode & aDIR) {
+               if (mode & FILE_ATTRIBUTE_DIRECTORY) {
                        size = 0;
                }
        }
@@ -1248,18 +1265,18 @@ void reply_setatr(struct smb_request *req)
        mode = SVAL(req->vwv+0, 0);
        mtime = srv_make_unix_date3(req->vwv+1);
 
-       ft.mtime = convert_time_t_to_timespec(mtime);
-       status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
-       if (!NT_STATUS_IS_OK(status)) {
-               reply_nterror(req, status);
-               goto out;
-       }
-
        if (mode != FILE_ATTRIBUTE_NORMAL) {
                if (VALID_STAT_OF_DIR(smb_fname->st))
-                       mode |= aDIR;
+                       mode |= FILE_ATTRIBUTE_DIRECTORY;
                else
-                       mode &= ~aDIR;
+                       mode &= ~FILE_ATTRIBUTE_DIRECTORY;
+
+               status = check_access(conn, NULL, smb_fname,
+                                       FILE_WRITE_ATTRIBUTES);
+               if (!NT_STATUS_IS_OK(status)) {
+                       reply_nterror(req, status);
+                       goto out;
+               }
 
                if (file_set_dosmode(conn, smb_fname, mode, NULL,
                                     false) != 0) {
@@ -1268,6 +1285,13 @@ void reply_setatr(struct smb_request *req)
                }
        }
 
+       ft.mtime = convert_time_t_to_timespec(mtime);
+       status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
+       if (!NT_STATUS_IS_OK(status)) {
+               reply_nterror(req, status);
+               goto out;
+       }
+
        reply_outbuf(req, 0, 0);
 
        DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
@@ -1375,7 +1399,7 @@ void reply_search(struct smb_request *req)
        char *directory = NULL;
        struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
-       SMB_OFF_T size;
+       off_t size;
        uint32 mode;
        struct timespec date;
        uint32 dirtype;
@@ -1428,7 +1452,7 @@ void reply_search(struct smb_request *req)
        status_len = SVAL(p, 0);
        p += 2;
 
-       /* dirtype &= ~aDIR; */
+       /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
 
        if (status_len == 0) {
                nt_status = filename_convert(ctx, conn,
@@ -1468,6 +1492,7 @@ void reply_search(struct smb_request *req)
                SCVAL(status,0,(dirtype & 0x1F));
 
                nt_status = dptr_create(conn,
+                                       NULL, /* req */
                                        NULL, /* fsp */
                                        directory,
                                        True,
@@ -1523,7 +1548,7 @@ void reply_search(struct smb_request *req)
        if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
                char buf[DIR_STRUCT_SIZE];
                memcpy(buf,status,21);
-               if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
+               if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
                                0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        goto out;
@@ -1549,8 +1574,8 @@ void reply_search(struct smb_request *req)
                         /DIR_STRUCT_SIZE));
 
                DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-                       directory,lp_dontdescend(SNUM(conn))));
-               if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
+                        directory,lp_dontdescend(ctx, SNUM(conn))));
+               if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
                        check_descend = True;
                }
 
@@ -1716,7 +1741,7 @@ void reply_open(struct smb_request *req)
        struct smb_filename *smb_fname = NULL;
        char *fname = NULL;
        uint32 fattr=0;
-       SMB_OFF_T size = 0;
+       off_t size = 0;
        time_t mtime=0;
        int info;
        files_struct *fsp;
@@ -1768,7 +1793,7 @@ void reply_open(struct smb_request *req)
                goto out;
        }
 
-       if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
+       if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
                                         OPENX_FILE_EXISTS_OPEN, &access_mask,
                                         &share_mode, &create_disposition,
                                         &create_options, &private_flags)) {
@@ -1795,7 +1820,7 @@ void reply_open(struct smb_request *req)
                &info);                                 /* pinfo */
 
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -1820,7 +1845,7 @@ void reply_open(struct smb_request *req)
 
        mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
 
-       if (fattr & aDIR) {
+       if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
                DEBUG(3,("attempt to open a directory %s\n",
                         fsp_str_dbg(fsp)));
                close_file(req, fsp, ERROR_CLOSE);
@@ -1943,7 +1968,8 @@ void reply_open_and_X(struct smb_request *req)
                goto out;
        }
 
-       if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
+       if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
+                                        smb_ofun,
                                         &access_mask, &share_mode,
                                         &create_disposition,
                                         &create_options,
@@ -1971,7 +1997,7 @@ void reply_open_and_X(struct smb_request *req)
                &smb_action);                           /* pinfo */
 
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -1988,7 +2014,7 @@ void reply_open_and_X(struct smb_request *req)
                        reply_nterror(req, NT_STATUS_DISK_FULL);
                        goto out;
                }
-               retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
+               retval = vfs_set_filelen(fsp, (off_t)allocation_size);
                if (retval < 0) {
                        close_file(req, fsp, ERROR_CLOSE);
                        reply_nterror(req, NT_STATUS_DISK_FULL);
@@ -2004,7 +2030,7 @@ void reply_open_and_X(struct smb_request *req)
 
        fattr = dos_mode(conn, fsp->fsp_name);
        mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
-       if (fattr & aDIR) {
+       if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
                close_file(req, fsp, ERROR_CLOSE);
                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                goto out;
@@ -2034,6 +2060,9 @@ void reply_open_and_X(struct smb_request *req)
                reply_outbuf(req, 15, 0);
        }
 
+       SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+       SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
+
        if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
                SCVAL(req->outbuf, smb_flg,
                      CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
@@ -2059,7 +2088,6 @@ void reply_open_and_X(struct smb_request *req)
                SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
        }
 
-       chain_reply(req);
  out:
        TALLOC_FREE(smb_fname);
        END_PROFILE(SMBopenX);
@@ -2073,32 +2101,55 @@ void reply_open_and_X(struct smb_request *req)
 void reply_ulogoffX(struct smb_request *req)
 {
        struct smbd_server_connection *sconn = req->sconn;
-       user_struct *vuser;
+       struct user_struct *vuser;
+       struct smbXsrv_session *session = NULL;
+       NTSTATUS status;
 
        START_PROFILE(SMBulogoffX);
 
        vuser = get_valid_user_struct(sconn, req->vuid);
 
        if(vuser == NULL) {
-               DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
-                        req->vuid));
+               DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
+                        (unsigned long long)req->vuid));
+
+               req->vuid = UID_FIELD_INVALID;
+               reply_force_doserror(req, ERRSRV, ERRbaduid);
+               END_PROFILE(SMBulogoffX);
+               return;
        }
 
-       /* in user level security we are supposed to close any files
-               open by this user */
-       if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
-               file_close_user(sconn, req->vuid);
+       session = vuser->session;
+       vuser = NULL;
+
+       /*
+        * TODO: cancel all outstanding requests on the session
+        */
+       status = smbXsrv_session_logoff(session);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0, ("reply_ulogoff: "
+                         "smbXsrv_session_logoff() failed: %s\n",
+                         nt_errstr(status)));
+               /*
+                * If we hit this case, there is something completely
+                * wrong, so we better disconnect the transport connection.
+                */
+               END_PROFILE(SMBulogoffX);
+               exit_server(__location__ ": smbXsrv_session_logoff failed");
+               return;
        }
 
-       invalidate_vuid(sconn, req->vuid);
+       TALLOC_FREE(session);
 
        reply_outbuf(req, 2, 0);
+       SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+       SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 
-       DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
+       DEBUG(3, ("ulogoffX vuid=%llu\n",
+                 (unsigned long long)req->vuid));
 
        END_PROFILE(SMBulogoffX);
        req->vuid = UID_FIELD_INVALID;
-       chain_reply(req);
 }
 
 /****************************************************************************
@@ -2193,7 +2244,7 @@ void reply_mknew(struct smb_request *req)
                NULL);                                  /* pinfo */
 
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -2325,7 +2376,7 @@ void reply_ctemp(struct smb_request *req)
        close(tmpfd);
 
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -2381,15 +2432,18 @@ void reply_ctemp(struct smb_request *req)
 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
                        uint16 dirtype)
 {
-       uint32 fmode;
-
        if (!CAN_WRITE(conn)) {
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
        }
 
-       fmode = dos_mode(conn, fsp->fsp_name);
-       if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
-               return NT_STATUS_NO_SUCH_FILE;
+       if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
+                       (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
+               /* Only bother to read the DOS attribute if we might deny the
+                  rename on the grounds of attribute missmatch. */
+               uint32_t fmode = dos_mode(conn, fsp->fsp_name);
+               if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
+                       return NT_STATUS_NO_SUCH_FILE;
+               }
        }
 
        if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
@@ -2449,16 +2503,16 @@ static NTSTATUS do_unlink(connection_struct *conn,
        fattr = dos_mode(conn, smb_fname);
 
        if (dirtype & FILE_ATTRIBUTE_NORMAL) {
-               dirtype = aDIR|aARCH|FILE_ATTRIBUTE_READONLY;
+               dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
        }
 
-       dirtype &= (aDIR|aARCH|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
+       dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
        if (!dirtype) {
                return NT_STATUS_NO_SUCH_FILE;
        }
 
        if (!dir_check_ftype(conn, fattr, dirtype)) {
-               if (fattr & aDIR) {
+               if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
                        return NT_STATUS_FILE_IS_A_DIRECTORY;
                }
                return NT_STATUS_NO_SUCH_FILE;
@@ -2489,13 +2543,13 @@ static NTSTATUS do_unlink(connection_struct *conn,
        }
 
        /* Can't delete a directory. */
-       if (fattr & aDIR) {
+       if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
                return NT_STATUS_FILE_IS_A_DIRECTORY;
        }
 #endif
 
 #if 0 /* JRATEST */
-       else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
+       else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
                return NT_STATUS_OBJECT_NAME_INVALID;
 #endif /* JRATEST */
 
@@ -2539,7 +2593,9 @@ static NTSTATUS do_unlink(connection_struct *conn,
        }
 
        /* The set is across all open files on this dev/inode pair. */
-       if (!set_delete_on_close(fsp, True, &conn->session_info->utok)) {
+       if (!set_delete_on_close(fsp, True,
+                               conn->session_info->security_token,
+                               conn->session_info->unix_token)) {
                close_file(req, fsp, NORMAL_CLOSE);
                return NT_STATUS_ACCESS_DENIED;
        }
@@ -2632,7 +2688,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                const char *dname = NULL;
                char *talloced = NULL;
 
-               if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
+               if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
                        status = NT_STATUS_OBJECT_NAME_INVALID;
                        goto out;
                }
@@ -2797,7 +2853,7 @@ void reply_unlink(struct smb_request *req)
        status = unlink_internals(conn, req, dirtype, smb_fname,
                                  path_contains_wcard);
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -2831,7 +2887,7 @@ static void fail_readraw(void)
  Fake (read/write) sendfile. Returns -1 on read or write fail.
 ****************************************************************************/
 
-ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
+ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
 {
        size_t bufsize;
        size_t tosend = nread;
@@ -2994,7 +3050,7 @@ static void reply_readbraw_error(struct smbd_server_connection *sconn)
 static void send_file_readbraw(connection_struct *conn,
                               struct smb_request *req,
                               files_struct *fsp,
-                              SMB_OFF_T startpos,
+                              off_t startpos,
                               size_t nread,
                               ssize_t mincount)
 {
@@ -3077,9 +3133,9 @@ static void send_file_readbraw(connection_struct *conn,
 
 normal_readbraw:
 
-       outbuf = TALLOC_ARRAY(NULL, char, nread+4);
+       outbuf = talloc_array(NULL, char, nread+4);
        if (!outbuf) {
-               DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
+               DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
                        (unsigned)(nread+4)));
                reply_readbraw_error(sconn);
                return;
@@ -3125,15 +3181,15 @@ void reply_readbraw(struct smb_request *req)
        struct smbd_server_connection *sconn = req->sconn;
        ssize_t maxcount,mincount;
        size_t nread = 0;
-       SMB_OFF_T startpos;
+       off_t startpos;
        files_struct *fsp;
        struct lock_struct lock;
-       SMB_OFF_T size = 0;
+       off_t size = 0;
 
        START_PROFILE(SMBreadbraw);
 
        if (srv_is_signing_active(sconn) ||
-           is_encrypted_packet(req->inbuf)) {
+           is_encrypted_packet(sconn, req->inbuf)) {
                exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
                        "raw reads/writes are disallowed.");
        }
@@ -3198,27 +3254,8 @@ void reply_readbraw(struct smb_request *req)
                /*
                 * This is a large offset (64 bit) read.
                 */
-#ifdef LARGE_SMB_OFF_T
 
-               startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
-
-#else /* !LARGE_SMB_OFF_T */
-
-               /*
-                * Ensure we haven't been sent a >32 bit offset.
-                */
-
-               if(IVAL(req->vwv+8, 0) != 0) {
-                       DEBUG(0,("reply_readbraw: large offset "
-                               "(%x << 32) used and we don't support "
-                               "64 bit offsets.\n",
-                       (unsigned int)IVAL(req->vwv+8, 0) ));
-                       reply_readbraw_error();
-                       END_PROFILE(SMBreadbraw);
-                       return;
-               }
-
-#endif /* LARGE_SMB_OFF_T */
+               startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
 
                if(startpos < 0) {
                        DEBUG(0,("reply_readbraw: negative 64 bit "
@@ -3261,9 +3298,9 @@ void reply_readbraw(struct smb_request *req)
                nread = 0;
 #endif
 
-       DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
+       DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
                "min=%lu nread=%lu\n",
-               fsp->fnum, (double)startpos,
+               fsp_fnum_dbg(fsp), (double)startpos,
                (unsigned long)maxcount,
                (unsigned long)mincount,
                (unsigned long)nread ) );
@@ -3290,7 +3327,7 @@ void reply_lockread(struct smb_request *req)
        connection_struct *conn = req->conn;
        ssize_t nread = -1;
        char *data;
-       SMB_OFF_T startpos;
+       off_t startpos;
        size_t numtoread;
        NTSTATUS status;
        files_struct *fsp;
@@ -3382,8 +3419,8 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        SCVAL(p,0,0); /* pad byte. */
        SSVAL(p,1,nread);
 
-       DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
-                fsp->fnum, (int)numtoread, (int)nread));
+       DEBUG(3,("lockread %s num=%d nread=%d\n",
+                fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
 
        END_PROFILE(SMBlockread);
        return;
@@ -3402,7 +3439,7 @@ void reply_read(struct smb_request *req)
        size_t numtoread;
        ssize_t nread = 0;
        char *data;
-       SMB_OFF_T startpos;
+       off_t startpos;
        int outsize = 0;
        files_struct *fsp;
        struct lock_struct lock;
@@ -3474,8 +3511,8 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        SCVAL(smb_buf(req->outbuf),0,1);
        SSVAL(smb_buf(req->outbuf),1,nread);
 
-       DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
-               fsp->fnum, (int)numtoread, (int)nread ) );
+       DEBUG(3, ("read %s num=%d nread=%d\n",
+                 fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
 
 strict_unlock:
        SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
@@ -3492,10 +3529,8 @@ static int setup_readX_header(struct smb_request *req, char *outbuf,
                              size_t smb_maxcnt)
 {
        int outsize;
-       char *data;
 
        outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
-       data = smb_buf(outbuf);
 
        memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
 
@@ -3503,7 +3538,7 @@ static int setup_readX_header(struct smb_request *req, char *outbuf,
        SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
        SSVAL(outbuf,smb_vwv5,smb_maxcnt);
        SSVAL(outbuf,smb_vwv6,
-             req_wct_ofs(req)
+             (smb_wct - 4)     /* offset from smb header to wct */
              + 1               /* the wct field */
              + 12 * sizeof(uint16_t) /* vwv */
              + 2);             /* the buflen field */
@@ -3519,7 +3554,7 @@ static int setup_readX_header(struct smb_request *req, char *outbuf,
 ****************************************************************************/
 
 static void send_file_readX(connection_struct *conn, struct smb_request *req,
-                           files_struct *fsp, SMB_OFF_T startpos,
+                           files_struct *fsp, off_t startpos,
                            size_t smb_maxcnt)
 {
        ssize_t nread = -1;
@@ -3557,7 +3592,8 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
         */
 
        if (!req_is_in_chain(req) &&
-           !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
+           !is_encrypted_packet(req->sconn, req->inbuf) &&
+           (fsp->base_fsp == NULL) &&
            (fsp->wcp == NULL) &&
            lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
                uint8 headerbuf[smb_size + 12 * 2];
@@ -3603,8 +3639,8 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
                                                 strerror(errno)));
                                        exit_server_cleanly("send_file_readX: fake_sendfile failed");
                                }
-                               DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
-                                       fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+                               DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
+                                         fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
                                /* No outbuf here means successful sendfile. */
                                goto strict_unlock;
                        }
@@ -3627,8 +3663,8 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
                        goto normal_read;
                }
 
-               DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
-                       fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+               DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
+                         fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
 
                /* Deal with possible short send. */
                if (nread != smb_maxcnt + sizeof(headerbuf)) {
@@ -3681,6 +3717,8 @@ normal_read:
 nosendfile_read:
 
        reply_outbuf(req, 12, smb_maxcnt);
+       SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+       SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 
        nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
        saved_errno = errno;
@@ -3694,10 +3732,8 @@ nosendfile_read:
 
        setup_readX_header(req, (char *)req->outbuf, nread);
 
-       DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
-                   fsp->fnum, (int)smb_maxcnt, (int)nread ) );
-
-       chain_reply(req);
+       DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
+                 fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
        return;
 
  strict_unlock:
@@ -3712,9 +3748,10 @@ nosendfile_read:
 
 void reply_read_and_X(struct smb_request *req)
 {
+       struct smbd_server_connection *sconn = req->sconn;
        connection_struct *conn = req->conn;
        files_struct *fsp;
-       SMB_OFF_T startpos;
+       off_t startpos;
        size_t smb_maxcnt;
        bool big_readX = False;
 #if 0
@@ -3750,7 +3787,15 @@ void reply_read_and_X(struct smb_request *req)
                return;
        }
 
-       if (global_client_caps & CAP_LARGE_READX) {
+       if ((sconn->smb1.unix_info.client_cap_low & CIFS_UNIX_LARGE_READ_CAP) ||
+           (get_remote_arch() == RA_SAMBA)) {
+               /*
+                * This is Samba only behavior (up to Samba 3.6)!
+                *
+                * Windows 2008 R2 ignores the upper_size,
+                * so we do unless unix extentions are active
+                * or "smbclient" is talking to us.
+                */
                size_t upper_size = SVAL(req->vwv+7, 0);
                smb_maxcnt |= (upper_size<<16);
                if (upper_size > 1) {
@@ -3762,7 +3807,7 @@ void reply_read_and_X(struct smb_request *req)
                        }
                        /* We currently don't do this on signed or sealed data. */
                        if (srv_is_signing_active(req->sconn) ||
-                           is_encrypted_packet(req->inbuf)) {
+                           is_encrypted_packet(req->sconn, req->inbuf)) {
                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
                                END_PROFILE(SMBreadX);
                                return;
@@ -3779,28 +3824,10 @@ void reply_read_and_X(struct smb_request *req)
        }
 
        if (req->wct == 12) {
-#ifdef LARGE_SMB_OFF_T
                /*
                 * This is a large offset (64 bit) read.
                 */
-               startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
-
-#else /* !LARGE_SMB_OFF_T */
-
-               /*
-                * Ensure we haven't been sent a >32 bit offset.
-                */
-
-               if(IVAL(req->vwv+10, 0) != 0) {
-                       DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
-                                "used and we don't support 64 bit offsets.\n",
-                                (unsigned int)IVAL(req->vwv+10, 0) ));
-                       END_PROFILE(SMBreadX);
-                       reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                       return;
-               }
-
-#endif /* LARGE_SMB_OFF_T */
+               startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
 
        }
 
@@ -3856,9 +3883,9 @@ void error_to_writebrawerr(struct smb_request *req)
 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
                                size_t *len)
 {
-       uint8_t msgtype = SMBkeepalive;
+       uint8_t msgtype = NBSSkeepalive;
 
-       while (msgtype == SMBkeepalive) {
+       while (msgtype == NBSSkeepalive) {
                NTSTATUS status;
 
                status = read_smb_length_return_keepalive(fd, inbuf, timeout,
@@ -3895,8 +3922,8 @@ void reply_writebraw(struct smb_request *req)
        ssize_t total_written=0;
        size_t numtowrite=0;
        size_t tcount;
-       SMB_OFF_T startpos;
-       char *data=NULL;
+       off_t startpos;
+       const char *data=NULL;
        bool write_through;
        files_struct *fsp;
        struct lock_struct lock;
@@ -3909,7 +3936,7 @@ void reply_writebraw(struct smb_request *req)
         * type of SMBwritec, not SMBwriteBraw, as this tells the client
         * we're finished.
         */
-       SCVAL(req->inbuf,smb_com,SMBwritec);
+       SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
 
        if (srv_is_signing_active(req->sconn)) {
                END_PROFILE(SMBwritebraw);
@@ -3955,8 +3982,8 @@ void reply_writebraw(struct smb_request *req)
                on whether we are using the core+ or lanman1.0 protocol */
 
        if(get_Protocol() <= PROTOCOL_COREPLUS) {
-               numtowrite = SVAL(smb_buf(req->inbuf),-2);
-               data = smb_buf(req->inbuf);
+               numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
+               data = smb_buf_const(req->inbuf);
        } else {
                numtowrite = SVAL(req->vwv+10, 0);
                data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
@@ -3987,9 +4014,9 @@ void reply_writebraw(struct smb_request *req)
                nwritten = write_file(req,fsp,data,startpos,numtowrite);
        }
 
-       DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
+       DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
                        "wrote=%d sync=%d\n",
-               fsp->fnum, (double)startpos, (int)numtowrite,
+               fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
                (int)nwritten, (int)write_through));
 
        if (nwritten < (ssize_t)numtowrite)  {
@@ -4001,7 +4028,7 @@ void reply_writebraw(struct smb_request *req)
        total_written = nwritten;
 
        /* Allocate a buffer of 64k + length. */
-       buf = TALLOC_ARRAY(NULL, char, 65540);
+       buf = talloc_array(NULL, char, 65540);
        if (!buf) {
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                error_to_writebrawerr(req);
@@ -4094,9 +4121,9 @@ void reply_writebraw(struct smb_request *req)
                goto strict_unlock;
        }
 
-       DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
+       DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
                "wrote=%d\n",
-               fsp->fnum, (double)startpos, (int)numtowrite,
+               fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
                (int)total_written));
 
        if (!fsp->print_file) {
@@ -4112,7 +4139,7 @@ void reply_writebraw(struct smb_request *req)
 #if RABBIT_PELLET_FIX
                /*
                 * Fix for "rabbit pellet" mode, trigger an early TCP ack by
-                * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
+                * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
                 * JRA.
                 */
                if (!send_keepalive(req->sconn->sock)) {
@@ -4145,7 +4172,7 @@ void reply_writeunlock(struct smb_request *req)
        connection_struct *conn = req->conn;
        ssize_t nwritten = -1;
        size_t numtowrite;
-       SMB_OFF_T startpos;
+       off_t startpos;
        const char *data;
        NTSTATUS status = NT_STATUS_OK;
        files_struct *fsp;
@@ -4235,8 +4262,8 @@ void reply_writeunlock(struct smb_request *req)
 
        SSVAL(req->outbuf,smb_vwv0,nwritten);
 
-       DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
-                fsp->fnum, (int)numtowrite, (int)nwritten));
+       DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
+                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
 strict_unlock:
        if (numtowrite && !fsp->print_file) {
@@ -4259,7 +4286,7 @@ void reply_write(struct smb_request *req)
        connection_struct *conn = req->conn;
        size_t numtowrite;
        ssize_t nwritten = -1;
-       SMB_OFF_T startpos;
+       off_t startpos;
        const char *data;
        files_struct *fsp;
        struct lock_struct lock;
@@ -4320,12 +4347,12 @@ void reply_write(struct smb_request *req)
                /*
                 * This is actually an allocate call, and set EOF. JRA.
                 */
-               nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
+               nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
                if (nwritten < 0) {
                        reply_nterror(req, NT_STATUS_DISK_FULL);
                        goto strict_unlock;
                }
-               nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
+               nwritten = vfs_set_filelen(fsp, (off_t)startpos);
                if (nwritten < 0) {
                        reply_nterror(req, NT_STATUS_DISK_FULL);
                        goto strict_unlock;
@@ -4362,7 +4389,7 @@ void reply_write(struct smb_request *req)
                SSVAL(req->outbuf,smb_err,ERRdiskfull);
        }
 
-       DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
+       DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
 strict_unlock:
        if (!fsp->print_file) {
@@ -4388,8 +4415,11 @@ bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
        connection_struct *conn = NULL;
        unsigned int doff = 0;
        size_t len = smb_len_large(inbuf);
+       struct smbXsrv_tcon *tcon;
+       NTSTATUS status;
+       NTTIME now = 0;
 
-       if (is_encrypted_packet(inbuf)) {
+       if (is_encrypted_packet(sconn, inbuf)) {
                /* Can't do this on encrypted
                 * connections. */
                return false;
@@ -4406,11 +4436,14 @@ bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
                return false;
        }
 
-       conn = conn_find(sconn, SVAL(inbuf, smb_tid));
-       if (conn == NULL) {
+       status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
+                                    now, &tcon);
+       if (!NT_STATUS_IS_OK(status)) {
                DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
                return false;
        }
+       conn = tcon->compat;
+
        if (IS_IPC(conn)) {
                DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
                return false;
@@ -4468,13 +4501,13 @@ void reply_write_and_X(struct smb_request *req)
        connection_struct *conn = req->conn;
        files_struct *fsp;
        struct lock_struct lock;
-       SMB_OFF_T startpos;
+       off_t startpos;
        size_t numtowrite;
        bool write_through;
        ssize_t nwritten;
        unsigned int smb_doff;
        unsigned int smblen;
-       char *data;
+       const char *data;
        NTSTATUS status;
        int saved_errno = 0;
 
@@ -4482,8 +4515,7 @@ void reply_write_and_X(struct smb_request *req)
 
        if ((req->wct != 12) && (req->wct != 14)) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-               END_PROFILE(SMBwriteX);
-               return;
+               goto out;
        }
 
        numtowrite = SVAL(req->vwv+10, 0);
@@ -4500,20 +4532,17 @@ void reply_write_and_X(struct smb_request *req)
                /* Can't do a recvfile write on IPC$ */
                if (IS_IPC(conn)) {
                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       END_PROFILE(SMBwriteX);
-                       return;
+                       goto out;
                }
                if (numtowrite != req->unread_bytes) {
                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       END_PROFILE(SMBwriteX);
-                       return;
+                       goto out;
                }
        } else {
                if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
                                smb_doff + numtowrite > smblen) {
                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       END_PROFILE(SMBwriteX);
-                       return;
+                       goto out;
                }
        }
 
@@ -4521,12 +4550,10 @@ void reply_write_and_X(struct smb_request *req)
        if (IS_IPC(conn)) {
                if (req->unread_bytes) {
                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                       END_PROFILE(SMBwriteX);
-                       return;
+                       goto out;
                }
                reply_pipe_write_and_X(req);
-               END_PROFILE(SMBwriteX);
-               return;
+               goto out;
        }
 
        fsp = file_fsp(req, SVAL(req->vwv+2, 0));
@@ -4534,41 +4561,22 @@ void reply_write_and_X(struct smb_request *req)
        write_through = BITSETW(req->vwv+7,0);
 
        if (!check_fsp(conn, req, fsp)) {
-               END_PROFILE(SMBwriteX);
-               return;
+               goto out;
        }
 
        if (!CHECK_WRITE(fsp)) {
                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-               END_PROFILE(SMBwriteX);
-               return;
+               goto out;
        }
 
        data = smb_base(req->inbuf) + smb_doff;
 
        if(req->wct == 14) {
-#ifdef LARGE_SMB_OFF_T
                /*
                 * This is a large offset (64 bit) write.
                 */
-               startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
-
-#else /* !LARGE_SMB_OFF_T */
-
-               /*
-                * Ensure we haven't been sent a >32 bit offset.
-                */
+               startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
 
-               if(IVAL(req->vwv+12, 0) != 0) {
-                       DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
-                                "used and we don't support 64 bit offsets.\n",
-                                (unsigned int)IVAL(req->vwv+12, 0) ));
-                       reply_nterror(req, NT_STATUS_ACCESS_DENIED);
-                       END_PROFILE(SMBwriteX);
-                       return;
-               }
-
-#endif /* LARGE_SMB_OFF_T */
        }
 
        /* X/Open SMB protocol says that, unlike SMBwrite
@@ -4625,16 +4633,13 @@ void reply_write_and_X(struct smb_request *req)
        }
 
        reply_outbuf(req, 6, 0);
+       SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+       SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
        SSVAL(req->outbuf,smb_vwv2,nwritten);
        SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
 
-       if (nwritten < (ssize_t)numtowrite) {
-               SCVAL(req->outbuf,smb_rcls,ERRHRD);
-               SSVAL(req->outbuf,smb_err,ERRdiskfull);
-       }
-
-       DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
-               fsp->fnum, (int)numtowrite, (int)nwritten));
+       DEBUG(3,("writeX %s num=%d wrote=%d\n",
+               fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
        status = sync_file(conn, fsp, write_through);
        if (!NT_STATUS_IS_OK(status)) {
@@ -4645,10 +4650,18 @@ void reply_write_and_X(struct smb_request *req)
        }
 
        END_PROFILE(SMBwriteX);
-       chain_reply(req);
        return;
 
 out:
+       if (req->unread_bytes) {
+               /* writeX failed. drain socket. */
+               if (drain_socket(req->sconn->sock, req->unread_bytes) !=
+                               req->unread_bytes) {
+                       smb_panic("failed to drain pending bytes");
+               }
+               req->unread_bytes = 0;
+       }
+
        END_PROFILE(SMBwriteX);
        return;
 }
@@ -4660,8 +4673,8 @@ out:
 void reply_lseek(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
-       SMB_OFF_T startpos;
-       SMB_OFF_T res= -1;
+       off_t startpos;
+       off_t res= -1;
        int mode,umode;
        files_struct *fsp;
 
@@ -4683,7 +4696,7 @@ void reply_lseek(struct smb_request *req)
 
        mode = SVAL(req->vwv+1, 0) & 3;
        /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
-       startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
+       startpos = (off_t)IVALS(req->vwv+2, 0);
 
        switch (mode) {
                case 0:
@@ -4706,7 +4719,7 @@ void reply_lseek(struct smb_request *req)
        if (umode == SEEK_END) {
                if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
                        if(errno == EINVAL) {
-                               SMB_OFF_T current_pos = startpos;
+                               off_t current_pos = startpos;
 
                                if(fsp_stat(fsp) == -1) {
                                        reply_nterror(req,
@@ -4733,8 +4746,8 @@ void reply_lseek(struct smb_request *req)
        reply_outbuf(req, 2, 0);
        SIVAL(req->outbuf,smb_vwv0,res);
 
-       DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
-               fsp->fnum, (double)startpos, (double)res, mode));
+       DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
+               fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
 
        END_PROFILE(SMBlseek);
        return;
@@ -4803,9 +4816,12 @@ void reply_exit(struct smb_request *req)
        return;
 }
 
-/****************************************************************************
- Reply to a close - has to deal with closing a directory opened by NT SMB's.
-****************************************************************************/
+struct reply_close_state {
+       files_struct *fsp;
+       struct smb_request *smbreq;
+};
+
+static void do_smb1_close(struct tevent_req *req);
 
 void reply_close(struct smb_request *req)
 {
@@ -4832,21 +4848,13 @@ void reply_close(struct smb_request *req)
                return;
        }
 
-       if(fsp->is_directory) {
-               /*
-                * Special case - close NT SMB directory handle.
-                */
-               DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
-               status = close_file(req, fsp, NORMAL_CLOSE);
-       } else {
-               time_t t;
-               /*
-                * Close ordinary file.
-                */
+       DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
+                 fsp->is_directory ? "directory" : "file",
+                 fsp->fh->fd, fsp_fnum_dbg(fsp),
+                 conn->num_files_open));
 
-               DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
-                        fsp->fh->fd, fsp->fnum,
-                        conn->num_files_open));
+       if (!fsp->is_directory) {
+               time_t t;
 
                /*
                 * Take care of any time sent in the close.
@@ -4854,16 +4862,49 @@ void reply_close(struct smb_request *req)
 
                t = srv_make_unix_date3(req->vwv+1);
                set_close_write_time(fsp, convert_time_t_to_timespec(t));
+       }
+
+       if (fsp->num_aio_requests != 0) {
+
+               struct reply_close_state *state;
+
+               DEBUG(10, ("closing with aio %u requests pending\n",
+                          fsp->num_aio_requests));
 
                /*
-                * close_file() returns the unix errno if an error
-                * was detected on close - normally this is due to
-                * a disk full error. If not then it was probably an I/O error.
+                * We depend on the aio_extra destructor to take care of this
+                * close request once fsp->num_aio_request drops to 0.
                 */
 
-               status = close_file(req, fsp, NORMAL_CLOSE);
-       }  
+               fsp->deferred_close = tevent_wait_send(
+                       fsp, fsp->conn->sconn->ev_ctx);
+               if (fsp->deferred_close == NULL) {
+                       status = NT_STATUS_NO_MEMORY;
+                       goto done;
+               }
 
+               state = talloc(fsp, struct reply_close_state);
+               if (state == NULL) {
+                       TALLOC_FREE(fsp->deferred_close);
+                       status = NT_STATUS_NO_MEMORY;
+                       goto done;
+               }
+               state->fsp = fsp;
+               state->smbreq = talloc_move(fsp, &req);
+               tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
+                                       state);
+               END_PROFILE(SMBclose);
+               return;
+       }
+
+       /*
+        * close_file() returns the unix errno if an error was detected on
+        * close - normally this is due to a disk full error. If not then it
+        * was probably an I/O error.
+        */
+
+       status = close_file(req, fsp, NORMAL_CLOSE);
+done:
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
                END_PROFILE(SMBclose);
@@ -4875,6 +4916,49 @@ void reply_close(struct smb_request *req)
        return;
 }
 
+static void do_smb1_close(struct tevent_req *req)
+{
+       struct reply_close_state *state = tevent_req_callback_data(
+               req, struct reply_close_state);
+       struct smb_request *smbreq;
+       NTSTATUS status;
+       int ret;
+
+       ret = tevent_wait_recv(req);
+       TALLOC_FREE(req);
+       if (ret != 0) {
+               DEBUG(10, ("tevent_wait_recv returned %s\n",
+                          strerror(ret)));
+               /*
+                * Continue anyway, this should never happen
+                */
+       }
+
+       /*
+        * fsp->smb2_close_request right now is a talloc grandchild of
+        * fsp. When we close_file(fsp), it would go with it. No chance to
+        * reply...
+        */
+       smbreq = talloc_move(talloc_tos(), &state->smbreq);
+
+       status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
+       if (NT_STATUS_IS_OK(status)) {
+               reply_outbuf(smbreq, 0, 0);
+       } else {
+               reply_nterror(smbreq, status);
+       }
+       if (!srv_send_smb(smbreq->sconn,
+                       (char *)smbreq->outbuf,
+                       true,
+                       smbreq->seqnum+1,
+                       IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
+                       NULL)) {
+               exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
+                                   "failed.");
+       }
+       TALLOC_FREE(smbreq);
+}
+
 /****************************************************************************
  Reply to a writeclose (Core+ protocol).
 ****************************************************************************/
@@ -4885,7 +4969,7 @@ void reply_writeclose(struct smb_request *req)
        size_t numtowrite;
        ssize_t nwritten = -1;
        NTSTATUS close_status = NT_STATUS_OK;
-       SMB_OFF_T startpos;
+       off_t startpos;
        const char *data;
        struct timespec mtime;
        files_struct *fsp;
@@ -4943,8 +5027,8 @@ void reply_writeclose(struct smb_request *req)
                close_status = close_file(req, fsp, NORMAL_CLOSE);
        }
 
-       DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
-                fsp->fnum, (int)numtowrite, (int)nwritten,
+       DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
+                fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
                 conn->num_files_open));
 
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
@@ -5003,8 +5087,8 @@ void reply_lock(struct smb_request *req)
        count = (uint64_t)IVAL(req->vwv+1, 0);
        offset = (uint64_t)IVAL(req->vwv+3, 0);
 
-       DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
-                fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
+       DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
+                fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
 
        br_lck = do_lock(req->sconn->msg_ctx,
                        fsp,
@@ -5074,8 +5158,8 @@ void reply_unlock(struct smb_request *req)
                return;
        }
 
-       DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
-                   fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
+       DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
+                   fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
 
        reply_outbuf(req, 0, 0);
 
@@ -5093,21 +5177,41 @@ void reply_unlock(struct smb_request *req)
 
 void reply_tdis(struct smb_request *req)
 {
+       NTSTATUS status;
        connection_struct *conn = req->conn;
+       struct smbXsrv_tcon *tcon;
+
        START_PROFILE(SMBtdis);
 
        if (!conn) {
                DEBUG(4,("Invalid connection in tdis\n"));
-               reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
+               reply_force_doserror(req, ERRSRV, ERRinvnid);
                END_PROFILE(SMBtdis);
                return;
        }
 
-       conn->used = False;
-
-       close_cnum(conn,req->vuid);
+       tcon = conn->tcon;
        req->conn = NULL;
 
+       /*
+        * TODO: cancel all outstanding requests on the tcon
+        */
+       status = smbXsrv_tcon_disconnect(tcon, req->vuid);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0, ("reply_tdis: "
+                         "smbXsrv_tcon_disconnect() failed: %s\n",
+                         nt_errstr(status)));
+               /*
+                * If we hit this case, there is something completely
+                * wrong, so we better disconnect the transport connection.
+                */
+               END_PROFILE(SMBtdis);
+               exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
+               return;
+       }
+
+       TALLOC_FREE(tcon);
+
        reply_outbuf(req, 0, 0);
        END_PROFILE(SMBtdis);
        return;
@@ -5223,8 +5327,8 @@ void reply_printopen(struct smb_request *req)
        reply_outbuf(req, 1, 0);
        SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
 
-       DEBUG(3,("openprint fd=%d fnum=%d\n",
-                fsp->fh->fd, fsp->fnum));
+       DEBUG(3,("openprint fd=%d %s\n",
+                fsp->fh->fd, fsp_fnum_dbg(fsp)));
 
        END_PROFILE(SMBsplopen);
        return;
@@ -5261,8 +5365,8 @@ void reply_printclose(struct smb_request *req)
                return;
        }
 
-       DEBUG(3,("printclose fd=%d fnum=%d\n",
-                fsp->fh->fd,fsp->fnum));
+       DEBUG(3,("printclose fd=%d %s\n",
+                fsp->fh->fd, fsp_fnum_dbg(fsp)));
 
        status = close_file(req, fsp, NORMAL_CLOSE);
 
@@ -5322,7 +5426,7 @@ void reply_printqueue(struct smb_request *req)
                TALLOC_CTX *mem_ctx = talloc_tos();
                NTSTATUS status;
                WERROR werr;
-               const char *sharename = lp_servicename(SNUM(conn));
+               const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
                struct rpc_pipe_client *cli = NULL;
                struct dcerpc_binding_handle *b = NULL;
                struct policy_handle handle;
@@ -5338,7 +5442,7 @@ void reply_printqueue(struct smb_request *req)
                status = rpc_pipe_open_interface(conn,
                                                 &ndr_table_spoolss.syntax_id,
                                                 conn->session_info,
-                                                &conn->sconn->client_id,
+                                                conn->sconn->remote_address,
                                                 conn->sconn->msg_ctx,
                                                 &cli);
                if (!NT_STATUS_IS_OK(status)) {
@@ -5494,13 +5598,13 @@ void reply_printwrite(struct smb_request *req)
 
        data = (const char *)req->buf + 3;
 
-       if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
+       if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
                reply_nterror(req, map_nt_error_from_unix(errno));
                END_PROFILE(SMBsplwr);
                return;
        }
 
-       DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
+       DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
 
        END_PROFILE(SMBsplwr);
        return;
@@ -5638,7 +5742,7 @@ void reply_rmdir(struct smb_request *req)
                &info);                                 /* pinfo */
 
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -5653,7 +5757,9 @@ void reply_rmdir(struct smb_request *req)
                goto out;
        }
 
-       if (!set_delete_on_close(fsp, true, &conn->session_info->utok)) {
+       if (!set_delete_on_close(fsp, true,
+                       conn->session_info->security_token,
+                       conn->session_info->unix_token)) {
                close_file(req, fsp, ERROR_CLOSE);
                reply_nterror(req, NT_STATUS_ACCESS_DENIED);
                goto out;
@@ -5815,9 +5921,9 @@ static void rename_open_files(connection_struct *conn,
        files_struct *fsp;
        bool did_rename = False;
        NTSTATUS status;
-       uint32_t new_name_hash;
+       uint32_t new_name_hash = 0;
 
-       for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
+       for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
            fsp = file_find_di_next(fsp)) {
                /* fsp_name is a relative path under the fsp. To change this for other
                   sharepaths we need to manipulate relative paths. */
@@ -5829,8 +5935,8 @@ static void rename_open_files(connection_struct *conn,
                if (fsp->name_hash != orig_name_hash) {
                        continue;
                }
-               DEBUG(10, ("rename_open_files: renaming file fnum %d "
-                          "(file_id %s) from %s -> %s\n", fsp->fnum,
+               DEBUG(10, ("rename_open_files: renaming file %s "
+                          "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
                           file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
                           smb_fname_str_dbg(smb_fname_dst)));
 
@@ -5843,7 +5949,7 @@ static void rename_open_files(connection_struct *conn,
 
        if (!did_rename) {
                DEBUG(10, ("rename_open_files: no open files on file_id %s "
-                          "for %s\n", file_id_string_tos(&lck->id),
+                          "for %s\n", file_id_string_tos(&lck->data->id),
                           smb_fname_str_dbg(smb_fname_dst)));
        }
 
@@ -5933,6 +6039,47 @@ static void notify_rename(connection_struct *conn, bool is_dir,
        TALLOC_FREE(parent_dir_dst);
 }
 
+/****************************************************************************
+ Returns an error if the parent directory for a filename is open in an
+ incompatible way.
+****************************************************************************/
+
+static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
+                                       const struct smb_filename *smb_fname_dst_in)
+{
+       char *parent_dir = NULL;
+       struct smb_filename smb_fname_parent;
+       struct file_id id;
+       files_struct *fsp = NULL;
+       int ret;
+
+       if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
+                       &parent_dir, NULL)) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       ZERO_STRUCT(smb_fname_parent);
+       smb_fname_parent.base_name = parent_dir;
+
+       ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
+       if (ret == -1) {
+               return map_nt_error_from_unix(errno);
+       }
+
+       /*
+        * We're only checking on this smbd here, mostly good
+        * enough.. and will pass tests.
+        */
+
+       id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
+       for (fsp = file_find_di_first(conn->sconn, id); fsp;
+                       fsp = file_find_di_next(fsp)) {
+               if (fsp->access_mask & DELETE_ACCESS) {
+                       return NT_STATUS_SHARING_VIOLATION;
+                }
+        }
+       return NT_STATUS_OK;
+}
+
 /****************************************************************************
  Rename an open file - given an fsp.
 ****************************************************************************/
@@ -5954,6 +6101,11 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
                return status;
        }
 
+       status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
        /* Make a copy of the dst smb_fname structs */
 
        status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
@@ -6123,8 +6275,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
                status = NT_STATUS_ACCESS_DENIED;
        }
 
-       lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
-                                 NULL);
+       lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
 
        /*
         * We have the file open ourselves, so not being able to get the
@@ -6405,7 +6556,7 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
 
                /* Quick check for "." and ".." */
                if (ISDOT(dname) || ISDOTDOT(dname)) {
-                       if (attrs & aDIR) {
+                       if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
                                sysdir_entry = True;
                        } else {
                                TALLOC_FREE(talloced);
@@ -6560,6 +6711,8 @@ void reply_mv(struct smb_request *req)
        TALLOC_CTX *ctx = talloc_tos();
        struct smb_filename *smb_fname_src = NULL;
        struct smb_filename *smb_fname_dst = NULL;
+       uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
+       uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
        bool stream_rename = false;
 
        START_PROFILE(SMBmv);
@@ -6602,7 +6755,7 @@ void reply_mv(struct smb_request *req)
                                  conn,
                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  name,
-                                 UCF_COND_ALLOW_WCARD_LCOMP,
+                                 src_ucf_flags,
                                  &src_has_wcard,
                                  &smb_fname_src);
 
@@ -6620,7 +6773,7 @@ void reply_mv(struct smb_request *req)
                                  conn,
                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  newname,
-                                 UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
+                                 dst_ucf_flags,
                                  &dest_has_wcard,
                                  &smb_fname_dst);
 
@@ -6653,7 +6806,7 @@ void reply_mv(struct smb_request *req)
                                  attrs, False, src_has_wcard, dest_has_wcard,
                                  DELETE_ACCESS);
        if (!NT_STATUS_IS_OK(status)) {
-               if (open_was_deferred(req->mid)) {
+               if (open_was_deferred(req->sconn, req->mid)) {
                        /* We have re-scheduled this call. */
                        goto out;
                }
@@ -6686,7 +6839,7 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
                        bool target_is_directory)
 {
        struct smb_filename *smb_fname_dst_tmp = NULL;
-       SMB_OFF_T ret=-1;
+       off_t ret=-1;
        files_struct *fsp1,*fsp2;
        uint32 dosattrs;
        uint32 new_create_disposition;
@@ -6731,7 +6884,8 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
        if (!target_is_directory && count) {
                new_create_disposition = FILE_OPEN;
        } else {
-               if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
+               if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
+                                                0, ofun,
                                                 NULL, NULL,
                                                 &new_create_disposition,
                                                 NULL,
@@ -6830,7 +6984,7 @@ NTSTATUS copy_file(TALLOC_CTX *ctx,
                goto out;
        }
 
-       if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
+       if (ret != (off_t)smb_fname_src->st.st_ex_size) {
                status = NT_STATUS_DISK_FULL;
                goto out;
        }
@@ -7557,8 +7711,8 @@ NTSTATUS smbd_do_locking(struct smb_request *req,
                return status;
        }
 
-       DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
-                 fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
+       DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
+                 fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
 
        return NT_STATUS_OK;
 }
@@ -7626,8 +7780,8 @@ void reply_lockingX(struct smb_request *req)
                bool result;
 
                DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
-                        "for fnum = %d\n", (unsigned int)oplocklevel,
-                        fsp->fnum ));
+                        "for %s\n", (unsigned int)oplocklevel,
+                        fsp_fnum_dbg(fsp)));
 
                /*
                 * Make sure we have granted an exclusive or batch oplock on
@@ -7643,9 +7797,9 @@ void reply_lockingX(struct smb_request *req)
                           message here - just ignore it. JRA. */
 
                        DEBUG(5,("reply_lockingX: Error : oplock break from "
-                                "client for fnum = %d (oplock=%d) and no "
+                                "client for %s (oplock=%d) and no "
                                 "oplock granted on this file (%s).\n",
-                                fsp->fnum, fsp->oplock_type,
+                                fsp_fnum_dbg(fsp), fsp->oplock_type,
                                 fsp_str_dbg(fsp)));
 
                        /* if this is a pure oplock break request then don't
@@ -7780,12 +7934,13 @@ void reply_lockingX(struct smb_request *req)
        }
 
        reply_outbuf(req, 2, 0);
+       SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
+       SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
 
-       DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
-                 fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
+       DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
+                 fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
 
        END_PROFILE(SMBlockingX);
-       chain_reply(req);
 }
 
 #undef DBGC_CLASS
@@ -7870,15 +8025,20 @@ void reply_setattrE(struct smb_request *req)
                goto out;
        }
 
+       if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
+               reply_nterror(req, NT_STATUS_ACCESS_DENIED);
+               goto out;
+       }
+
        status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
        if (!NT_STATUS_IS_OK(status)) {
                reply_nterror(req, status);
                goto out;
        }
 
-       DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
+       DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
               " createtime=%u\n",
-               fsp->fnum,
+               fsp_fnum_dbg(fsp),
                (unsigned int)ft.atime.tv_sec,
                (unsigned int)ft.mtime.tv_sec,
                (unsigned int)ft.create_time.tv_sec
@@ -7971,7 +8131,7 @@ void reply_getattrE(struct smb_request *req)
        srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
                          convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
 
-       if (mode & aDIR) {
+       if (mode & FILE_ATTRIBUTE_DIRECTORY) {
                SIVAL(req->outbuf, smb_vwv6, 0);
                SIVAL(req->outbuf, smb_vwv8, 0);
        } else {
@@ -7981,7 +8141,7 @@ void reply_getattrE(struct smb_request *req)
        }
        SSVAL(req->outbuf,smb_vwv10, mode);
 
-       DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
+       DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
 
        END_PROFILE(SMBgetattrE);
        return;